horizon-telemetry, shared by the launcher, the game and the ingest server:
- consent.json in the game folder: four switches, all off until the player
answers, a consent version that re-asks when what is collected changes, the
answer's time, and a random install ID made at the first yes.
- Payloads: perf summaries (percentiles + 14 frame-time buckets from a
fixed-size Timings recorder), crash and bug reports, and benchmark reports
carried as docs/benchmark-report.md defines them; size caps per kind.
- A scrubber for user folders, user names, e-mail and IP addresses, UUIDs and
caller-known private terms.
- The outbox: only allowed kinds get in, daily caps, 200 items / 2 MiB.
- zstd batches with bounded decoding; the uploader re-reads the consent and
drops withdrawn items before connecting, backs off and caps batches a day.
- tests/consent_gating.rs: a local mock server sees zero connections with the
consent missing, outdated or withdrawn.
No server is set (DEFAULT_ENDPOINT is None): nothing is sent yet.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Ludovic Marie
43138159b2